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Abstract. We use a method recently introduced by Simone and Skoric 
to study accusation probabilities for non-binary Tardos fingerprinting 
codes. We generalize the pre-computation steps in this approach to in- 
clude a broad class of collusion attack strategies. We analytically derive 
properties of a special attack that asymptotically maximizes false ac- 
cusation probabilities. We present numerical results on sufficient code 
lengths for this attack, and explain the abrupt transitions that occur in 
these results. 

1 Introduction 

1.1 Collusion attacks against forensic watermarking. 

Watermarking provides a means for tracing the origin and distribution of digital 
data. Before distribution of digital content, the content is modified by applying 
an imperceptible watermark (WM), embedded using a watermarking algorithm. 
Once an unauthorized copy of the content is found, it is possible to trace those 
users who participated in its creation. This process is known as 'forensic water- 
marking'. Reliable tracing requires resilience against attacks that aim to remove 
the WM. Collusion attacks, where a group of pirates cooperate, are a partic- 
ular threat: differences between their versions of the content tell them where 
the WM is located. Coding theory has produced a number of collusion-resistant 
codes. The resulting system has two layers |5l9j : The coding layer determines 
which message to embed and protects against collusion attacks. The underlying 
watermarking layer hides symbols of the code in segments of the content. The 
interface between the layers is usually specified in terms of the Marking Assump- 
tion plus additional assumptions that are referred to as a 'model'. The Marking 
Assumption states that the colluders are able to perform modifications only in 
those segments where they received different WMs. These segments are called 
detectable positions. The 'model' specifies the kind of symbol manipulations that 
the attackers are able to perform in detectable positions. In the Restricted Digit 
Model (RDM) the attackers must choose one of the symbols that they have re- 
ceived. The unreadable digit model also allows for erasures. In the arbitrary digit 
model the attackers can choose arbitrary symbols, while the general digit model 
additionally allows erasures. 

1.2 Tardos codes . 

Many collusion resistant codes have been proposed in the literature. Most notable 
are the Boneh-Shaw construction [3] and the by now famous Tardos code [12]. 



The former uses a concatenation of an inner code with a random outer code, while 
the latter one is a fully randomized binary code. In Tardos' original paper |12| a 
binary code was given achieving length m = lOOcg [In ^] , along with a proof that 
m cx c§ is asympotically optimal for large coalitions, for all alphabet sizes. Here 
Co denotes the number of coUuders to be resisted, and ei is the maximum allowed 
probability of accusing a fixed innocent user. Tardos' original construction had 
two unfortunate design choices which caused the high proportionality constant 
100. (i) The false negative probability £2 (not accusing any attacker) was set 
as £2 = £1°^^, even though £2 ^ £1 is highly unusual in the context of content 
distribution; a deterring effect is achieved already at £2 « |, while £1 needs to be 
very small. In the subsequent literature (e.g. |15l2j ) the £2 was decoupled from 
£1, substantially reducing m. (ii) The symbols and 1 were not treated equally. 
Only segments where the attackers produce a 1 were taken into account. This 
ignores 50% of all information. A fully symbol-symmetric version of the scheme 
was given in [13] , leading to a further improvement of m by a factor 4. A further 
improvement was achieved in [8] . The code construction contains a step where a 
bias parameter is randomly set for each segment. In Tardos' original construction 
the probability density function (pdf) for the bias is a continuous function. In 
[S] a class of discrete distributions was given that performs better than the 
original pdf against finite coalition sizes. In |16ll4j the Marking Assumption 
was relaxed, and the accusation algorithm of the nonbinary Tardos code was 
modified to effectively cope with signal processing attacks such as averaging and 
addition of noise. 

All the above mentioned work followed the so-called 'simple decoder' approach, 
i.e. an accusation score is computed for each user, and if it exceeds a certain 
threshold, he is considered suspicious. One can also use a 'joint decoder' which 
computes scores for sets of users. Amiri and Tardos [I] have given a capacity- 
achieving joint decoder construction for the binary code. (Capacity refers to the 
information-theoretic treatment [11 7 6J of the attack as a channel.) However, the 
construction is rather impractical, requiring computations for many candidate 
coalitions. In jl3| the binary construction was generalized to g-ary alphabets, in 
the simple decoder approach. In the RDM, the transition to a larger alphabet 
size has benefits beyond the mere fact that a f^-ary symbol carries log2 q bits of 
information. 

1.3 The Gaussian approximation. 

The Gaussian approximation, introduced in |15j . is a useful tool in the analysis 
of Tardos codes. The assumption is that the accusations are normal-distributed. 
The analysis is then drastically simplified; in the RDM the scheme's performance 
is almost completely determined by a single parameter, the average accusation 
li of the coalition (per segment). The sufficient code length against a coalition 
of size c is m = {2/jl'^)c^ ln(l/£i). The Gaussian assumption is motivated by the 
Central Limit Theorem (CLT): An accusation score consists of a sum of i.i.d. 
per-segment contributions. When many of these get added, the result is close to 
normal-distributed: the pdf is close to Gaussian in a region around the average, 
and deviates from Gaussian in the tails. The larger m is, the wider this central 



region. In |15|13j it was argued that in many practical cases the central region is 
sufficiently wide to allow for application of the Gaussian approximation. In [lOj 
a semi-analytical method was developed for determining the exact shape of the 
pdf of innocent users' accusations, without simulations. This is especially useful 
in the case of very low accusation probabilities, where simulations would be very 
time-consuming. The false accusation probabilities were studied for two attacks: 
majority voting and interleaving. 
1.4 Contributions . 

We discuss the simple decoder in the RDM, choosing £2 « ^. We follow the 
approach of |10| for computing false accusation probabilities. Our contribution 
is threefold: 

1. We prove a number of theorems (Theorems [lj|3]) that allow efficient compu- 
tation of pdfs for more general attacks than the ones treated in [10^ . 

2. We identify which attack minimizes the all-importanl[^ parameter jl. It was 
shown in [10 that the majority voting attack achieves this for certain parameter 
settings, but we consider more general parameter values. We derive some basic 
properties of the attack. 

3. We present numerical results for the /2-minimizing attack. When the coalition 
is small the graphs contain sharp transitions; we explain these transitions as an 
effect of the abrupt changes in pdf shape when the attack turns from majority 
voting into minority voting. 

2 Notation and preliminaries 

We briefly describe the q-ary version of the Tardos code as introduced in [IB] 
and the method of [101 to compute innocent accusation probabilities. 
2.1 The q-ary Tardos code. 

The number of symbols in a codeword is m. The number of users is n. The 
alphabet is Q, with size q. Xji G Q stands for the i'th symbol in the codeword 
of user j. The whole matrix of codewords is denoted as X. 
Two-step code generation, m vectors p'-*-' € [0, 1]"^ are independently drawn ac- 
cording to a distribution F, with 



Here Iq stands for the vector (1, • • • ,1) of length q, S{-) is the Dirac delta 
function, and B is the generalized Beta function, k is a positive constant. For 
Vi, ■ • • ,Vn > the Beta function is defined asp] 



^ Asymptotically for large m, the /i-minimizing attack is the 'worst case' attack in 

the RDM in the sense that the false accusation probability is maximized. 
^ This is also known as a Dirichlet integral. The ordinary Beta function (n — 2) is 




(1) 




B{x,y)^r{x)r{y)/r{x + y). 



All elements Xji are drawn independently according to FT[Xji 

Attack . The coalition is C, with size c. The i'th segment of the pirated content 

contains a symbol i/i £ Q. We define vectors cr^') S as 

a« ^ \{j e C : X,. = a}| (3) 

satisfying X^aeg '^"^ ~ words: tJa'' counts how many coUuders have received 
symbol a in segment i. The attack strategy may be probabilistic. As usual, 
it is assumed that this strategy is column-symmetric, symbol-symmetric and 
attacker-symmetric. It is expressed as probabilities Oy^^r that apply independently 
for each segment. Omitting the column index, 

Pv[y\a] = 0y\^. (4) 

Accusation . The watermark detector sees the symbols y^. For each user j, the 
accusation sum Sj is computed, 

rn 

S,=J2^? where = g[x,.=^y^{pl^), (5) 

i=l 

where the expression [Xji —— y,] evaluates to 1 if Xji — yi and to otherwise, 
and the functions go and gi are defined as 



The total accusation of the coalition is 5 :— J^j^c^j- '^^^'^ choice (j6]) is the 
unique choice that satisfies 

pgi{p) + {i-p)go{p)^o ; pMp)? + {i - p)[go{p)? ^ i- (7) 

This has been shown to have optimal properties for q — 2 |4ll5j . Its unique 
properties ([t]) also hold for q > 3; that is the main motivation for using A 
user is 'accused' if his accusation sum exceeds a threshold Z, i.e. 5*^ > Z. 
The parameter p, is defined as ^£[5*], where E stands for the expectation value 
over all random variables. The p, depends on q, k, the collusion strategy, and 
weakly on c. In the limit of large c it converges to a finite value, and the code 
length scales as c'^/jl'^. 

2.2 Marginal distributions and strategy parametrization. 

Because of the independence between segments, the segment index will be dropped 
from this point onward. For given p, the vector cr is multinomial-distributed, 
P(cr|p) = (^) Ha Pa" ■ Averaged over p, the a has distribution P(cr) = (^) ^^^^'^J^ ■ 
Two important marginals were given in jlOj. First, the marginal probability 
Pi(^) ~ P^i'^a ~ b] for one arbitrary component a, 

V (h\- f B{K + b,K[q-l]+c-b) 



Second, given that CTq — b, the probabihty that the remaining q — 1 components 
of the vector cr are given by x, 

It is always impHcit that J2i3eQ\{a} xp — c — b. 

An alternative parametrization was introduced for the collusion strategy, which 
exploits the fact that (i) O^icr is invariant under permutation of the symbols ^ a; 
(ii) ^q|<t depends on a only through the value of ctq. 



'l'b{x) = 6^\^ given that =b and x = the other components of cr. (10) 



Thus, 'I^bix) is the probability that the pirates choose a symbol that they have 
seen b times, given that the other symbols' occurences are x. Strategy-dependent 
parameters were introduced as follows. 



Kh ^ E^ibMx) = ^P,-i(a;|6)tf'b(a;). 



(11) 



Due to the marking assumption Kq — and Kc — 1. The Ki, obey the sum rule 
g^lJ^Q iff,Pi(&) = 1. Efficient pre-computation of the Ki, parameters can speed 
up the computation of a number of quantities of interest, among which the p, 
parameter. It was shown that fl can be expressed as 



= E W E ^a^n^a) =<Z^™(&)r(&), 



(12) 



aeQ 



fc=0 



where 



T{b) ^ 



K H — (nq 
c 



r{b + n-\)r{c-b + n[q-l]-\) 

r{b + n) r{c-b + K[q-i]) ■ ^ ' 



2.3 Method for computing false accusation probabilities. 

The method of 10 is based on the convolution rule for generating functions 
(Fourier transforms) : Let Ai ~ /i and A2 ^ /2 be continuous random variables, 
and let /i, /2 be the Fourier transforms of the respective pdfs. Let A = Ai + A2. 
Then the easiest way to compute the pdf of A (say ^) is to use the fact that 
<^(fc) = fi{k)f2{k). If m i.i.d. variables Ai ^ (p are added, A = X^i^ii then the 
pdf of A is found using <P{k) = [(^(/c)]™. In [10] the pdf (p was derived for an 



innocent user's one-segment accusation 
to be 



. The Fourier transform was found 



2q 



B{K,K[q-l]) 



E 

6=1 



A{db, Vb; k) + A{vb -1,4 + 1; -k) 



(14) 



with 



db = b + K ; Vb = c — b + K[q — 1] + 1 



Aid, V- k) - {-ikf^r{-2v) ^F^iv+d- v+\,v+l- + i ^B{d+l,v-l). 

Using this result for <f it is then possible to cast the expression (^™ in the following 
special form, 
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CL;t(TO)(isgnfc)"*|A:|'' 



(15) 



where at are real numbers; the coefficients Wt(m) are real; the powers Vt satisfy 
vq> 1, vt+i > i^t- In general the are not all integer. The Wt decrease with in- 
creasing m as m~'^*/^ or faster. Computing all the a*, wt, vt up to a certain cutoff 
t = ^max is straightforward but laborious, and leads to huge expressions if done 
analytically; it is best done numerically, e.g. using series operations in Mathe- 
matica. Once all these coefficients are known, the false accusation probability is 
computed as follows. Let i?,„ be a function dcffiied as Rm{Z) :— Pr[S'j > Zy/m] 
(for innocent j). Let f2 be the corresponding function in case the pdf of 5"^ is 
Gaussian, Q{Z) = iErfc(Z/^/2). Then 



R^{Z) = n{Z) + - V 0Jt{m)r{iyt)2'"/^lm 

TT ^ — ' 

t=0 



i-"'H_,^{iZ/V2) 



(16) 



Here H is the Hermite function. It holds that lim,n^^ R„i{Z) = f2{Z). For a 
good numerical approximation it suffices to take terms up to some cutoff imax- 
The required imax is a decreasing function of m. 



3 Our results 

3.1 Computing Kf, for several classes of colluder strategy. 

Our first contribution is a prescription for efficiently computing the Kb parame- 
ters for more general colluder strategies than those studied in |IOj. We consider 
the strategy parametrization 'l'b{x) with b 0. The vector x S N"^"^ can contain 
several entries equal to b. The number of such entries will be denoted as i. (The 
dependence of on 6 and x is suppressed in the notation for the sake of brevity.) 
The number of remaining entries is r = q — 1 — i. These entries will be denoted 
as 2 = (zi, • • • , Zr), with Zj ^ 6 by definition. Any strategy possessing the sym- 
metries mentioned in Section [2] can be parametrized as a function !f'b(a;) which 
in turn can be expressed as a function of b, I and 2; it is invariant under per- 
mutation of the entries in z. We will concentrate on the following 'factorizable' 
classes of attack, each one a sub-class of the previous one. 

Class 1: ^b(x) is of the form w(6, i) HLi -^fe) 
Class 2: -^bix) is of the form |^ OLi ^k) 

Class 3: tf'&(a;) is of the form nl-=i ^fe): "^ith W[b,z-k) G {0,1} and 
Wib, Zk) + W{zk, b) = 1. By definition W{b, 0) = 1. 



Class 1 merely restricts the dependence on 2; to a form factorizable in the com- 
ponents Zfc. This is a very broad class, and contains e.g. the interleaving attack 
(^a|(T — ^7 ^b{x) — ^) which has no dependence on z. 

Class 2 puts a further restriction on the ^-dependence. The factor 1/(^-1-1) implies 
that symbols with equal occurrence have equal probability of being selected by 
the coUuders. (There are symbols that occur h times.) 
Class 3 restricts the function to a binary 'comparison' of its two arguments: 
^b{x) is nonzero only if h is 'better' than for all fc, i.e. W{b,Zk) — 1. An 
example of such a strategy is majority voting, where ^b{x) = if there exists a 
k such that Zk > b, and 'l'b{x) = if Zk < b for all k. Class 3 also contains 
minority voting, and in fact any strategy which uses a strict ordering or 'ranking' 
of the occurrence counters b, z^. (Here a zero always counts as 'worse' than 
nonzero.) 

Our motivation for introducing classes 1 and 2 is mainly technical, since they 
affect to which extent the Kb parameters can be computed analytically. In the 
next section we will see that class 3 captures not only majority/minority voting 
but also the /i-reducing attack. 

Theorem 1. Let Nb e N satisfy Nb > max{c - b,\c- bq\, (c - b){q - 2)}. Let 

^ ^ ^ r{K^z)W{b,i,z) A r{K^b) 

Ghal - 2^ -^^y , Vba - ,,,, • (17) 

ze{o,...,c-f)}\{h} ' b ■ 

Then for strategies in class 1 it holds that 



Theorem 2. For strategies in class 2 the quantity Gbai cls defined in ^li^ does 
not depend on £ and can be denoted as Gba (with W{b, I, z) replaced by W{b, z) ). 
It then holds that 

_ b\{c-b)\w{b) 

qNbr[K. + b)r[c-b + K[q-l\)B(Klg^i) ^ 

Theorem 3. For strategies in class 3, Theorem^ holds, where w{b) — 1 and 
Gba can be expressed as 



zeio.....a-b}\{b} b 
W{b,z) = l 



The proofs of Theorems [T}|3] are given in the Appendix. Without these theorems. 



straightforward computation of Kb following (111 would require a full sum over 



X, which for large c comprises 0{c'^ ^/(g — 1)!) different terms, {q — 1 variables 



< c — b, with one constraint, and with permutation symmetry. We neglect the 
dependence on b.) Theorem [l] reduces the number of terms to 0{q^c^) at worst; 
a factor c from computing G^a, a factor q from and a factor Ni, from 
with Nb < qc. In Theorem [2] the £-sum is ehminated, resulting in 0{qc^) terms. 
We conclude that, for g > 5 and large c, Theorems [T] and [2] can significantly 
reduce the time required to compute the parameters]^ A further reduction 
occurs in Class 3 if the W{b, z) function is zero for many z. 

3.2 The /i-minimizing attack. 

Asymptotically for large code lengths the colluder strategy has negligible impact 
on the Gaussian shape of the innocent (and guilty) accusation pdf. For 9 > 3 
the main impact of their strategy is on the value of the statistical parameter ji. 
(For the binary symmetric scheme with k = ^, the fi is fixed at ^ ; the attackers 
cannot change it. Then the strategy's impact on the pdf shape is not negligible.) 
Hence for q > 3 the strategy that minimizes /i is asymptotically a 'worst-case' 
attack in the sense of maximizing the false positive probability. This was already 
argued in 1131, and it was shown how the attackers can minimize p.. From the 



first expression in ( 12 ) it is evident that, for a given cr, the attackers must choose 
the symbol y such that T{ay) is minimal, i.e. y — arg min^ T((Tq). In case of a 
tie it does not matter which of the best symbols is chosen, and without loss 
of generality we impose symbol symmetry, i.e. if the minimum T{aa) is shared 
by N different symbols, then each of these symbols will have probability \/N 
of being elected. Note that this strategy fits in class 3. The function W{b,Z}.) 
evaluates to 1 if T{b) < T{zk) and to otherwise]^ 

Let us introduce the notation x = b/ c, x G (0, 1). Then for large c we have |10j 

, , i — K + xinq — 1) , ^ 



From ( 19 ) we deduce some elementary properties of the function T. 



^ < 2(g-i) then T is monotonically decreasing, and T{b) may become 
negative at large b. 

— If K > I , then T is monotonically increasing, and T{b) may become negative 
at small b. 

— For K in between those values, T{b) is nonnegative and has a minimum at 
^ w - 1) 

We expect that the existence of negative T{b) values has a very bad impact on 
jl, and hence that k is best chosen in the interval (2(^^33^, |)- 
Fig.[l]shows the function T{b) for two values of n outside this 'safe' interval. For 
K = 0.2 it is indeed the case that T{b) < at large b, and for k ~ 0.9 at small b. 



To get some feeling for the orders of magnitude: The crossover point where qc = 
c''~^/{q - 1)! lies at c = 120, 27, 18, 15, 13, for q =5, 6, 7, 8, 9 respectively. 
* For x,y €N, with x y, it does not occur in general that T{x) — T{y). The only 
way to make this happen is to choose k in a very special way as a function of q and c. 
W.l.o.g. we assume that k is not such a pathological case. 
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Fig. 1. The function T{b) for q = 3, c = 20 and two values k outside , i). 



Note that T(c) is always positive due to the Marking Assumption. For small k, 
the r(6)-ranking of the points is clearly such that majority voting is the best 
strategy; similarly, for large k minority voting is best. For intermediate values 
of K a more complicated ranking will occur. 

3.3 Numerical results for the //-minimizing attack. 

In lOj the //-minimizing attack was studied for a restricted parameter range, 
K « 1/q. For such a choice of k the strategy reduces to majority voting. We study 
a broader range, applying the full /i-minimizing attack. We use Theorem |3] to 



precompute the Kf, and then ( 14 ), ( 15 ) and ( 16 ) to compute the false accusation 
probability Rm as a function of the accusation threshold. We found that keeping 
terms in the expansion with vt < 37 gave stable results. 

For a comparison with [10], we set £i ~ 10^^°, and search for the smallest 
codelength m* for which it holds that R„i{fiy/rri/c) < ei. The special choice Z = 
fx^frnjc puts the threshold at the expectation value of a coUuder's accusation. 
As a result the probability of a false negative error is « |. Our results for m* 
are consistent with the numbers given in |10| . 

In Fig. [2] we present graphs of 2//t^ as a function of k, for various g, c. If 
the accusation pdf is Gaussian, then the quantity 2//i^ is very close to the 
proportionality constant in the equation m oc ln(l/ei). We also plot ^2 ii^i/ei) 
as a function of k for various g, c. Any discrepancy between the /i and plots 
is caused by non-Gaussian tail shapes. 

In the plots on the left we see that the attack becomes very powerful (very large 
2//x^) around k = 5, especially for large coalitions. This can be understood from 
the fact that the T(6) values are decreasing, and some even becoming negative for 
K> as discussed in Section 3.2. This effect becomes weaker when q increases. 
The plots also show a strong deterioration of the scheme's performance when n 
approaches 2{q-\) ' expected. 



^ The \i can become negative. These points are not plotted, as they represent a 
situation where the accusation scheme totally fails, and there exists no sufficient 
code length m*.) 
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Fig. 2. Numerical results for the jl-minimizing attack, ei — 10 Left: The 
Gaussian-limit code length constant as a function of k, for various q and c. 
Right: The sufficient code length m*, scaled by the factor c^hi{l/ei) for easy 
comparison to the Gaussian limit. 



For small and large k, the left and right graphs show roughly the same be- 
haviour. In the middle of the K-range, however, the is very irregular. We 
think that this is caused by rapid changes in the 'ranking' of b values induced 
by the function T{b); there is a transition from majority voting (at small k) to 
minority voting (at large k). It was shown in 10 that (i) majority voting causes 
a more Gaussian tail shape than minority voting; (ii) increasing k makes the 
tail more Gaussian. These two effects together explain the graphs in Fig. [2j 
first, the transition for majority voting to minority voting makes the tail less 
Gaussian (hence increasing m* ) , and then increasing k gradually makes the tail 
more Gaussian again (reducing to*). 

In Fig. |3] we show the shape of the false accusation pdf of both sides of the 
transition in the q ~ 3, c ~ 7 plot. For the smaller k the curve is better than 
Gaussian up to false accusation probabilities of better than 10""'^''. For the larger 
K the curve becomes worse than Gaussian around 10~®, which lies significantly 
above the desired 10~^°. 

The transition from majority to minority voting is cleanest for q — 2, and was 
already shown in [13^ to lie precisely at k = ^ for all c. For q > 3 it depends on 
c and is less easy to pinpoint. 
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Fig. 3. Accusation probability for a fixed innocent user as a function of the 
(scaled) accusation threshold Z ~ Z/^Jrn. The attack is the p,- minimizing at- 
tack. The graph shows the Gaussian limit, and two parameter settings which 
correspond to 'before' and 'after' a sharp transition. 



4 Discussion 



We have tested the pdf computation method of [TU] for a large range of parameter 
values and for the various 'rankings' that are part of the /i-minimizing attack. 
The method has performed well under all these conditions. 
Our results reveal the subtle interplay between the average coUuder accusation 
p, and the shape of the pdf of an innocent user's accusation sum. The sharp 
transitions that occur in Fig. [2] show that there is a K-range (to the left of the 
transition) where the /i- reducing attack is not optimal for small coalitions. It is 
not yet clear what the optimal attack would be there, but certainly it has to be 
an attack that concentrates more on the pdf shape than on fl, e.g. the minority 
voting or the interleaving attack. 

For large coalitions the pdfs are very close to Gaussian. From the optimum points 
TTi;^ as a function of k we see that it can be advantageous to use an alphabet 
size q > 2. (Even if a non-binary symbol occupies logj q times more space in the 
content than a binary symbol.) 
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A Proofs 



Proof of Theorem [T] 



We start from (11), with Pg_i defined in and reorganize the x-smn to take 
the multiplicity £ into account: 

X £=0 ^ ^ ze({o,...,c.~b}\{b}Y 

1=0 ^ ^ zie{0,...,c-&}\{6} z^e{0,...,c-fc}\{6} 

where 5 is the Kronecker delta, and ^,nax = minjg — 1, [^y^J}. The factor 



pops up because the summand in (11) is fully symmetric under permutations 



of X. The Kronecker delta takes care of the constraint that the components of z 
add up to c — 6 — £6. 

If -^max = Lnr^J ^^"^ ^ extended beyond £max, then all the addi- 

tional terms are zero, because the Kronecker delta condition cannot be satisfied. 
(The X]fc would have to become negative.) Hence we are free to replace the 
upper summation bound ^max by g — 1 without changing the result of the sum. 
Next we use a sum representation of the Kronecker 5 as follows, 

-, Wb-i 

^wT. (e''^/'^')"^ (20) 

a=0 

with s = c — b{l + \) — Zfc. This is a correct representation only if is larger 
than the maximum \s\ that can occur. The most positive possible value of s is 
attained at (£ = 0, z = 0), namely s = c — b. The most negative value (sneg) is 
attained when z^. — c — b for all k. Since there are r = q — I — £ components in 
z, we have Sncg = min£[c — b{£ + 1) — (g — 1 — £)(c — 6)]. The function is linear 
in £, so there are only two candidates: the extreme values £ = and £ — q ~ 1, 
which yield |snog| = il — 2)(c — 6) and jsnogl = |c — bq\ respectively. Hence Ni, 
has to be larger than max{c — b,{q — 2)(c — 6), |c — bq\}. 



Our expression for Ki, now contains sums over i, Zk and a. We shift the a-sum 
completely to the left. Next we write 



r{c-b + K[q-l]) 
{c-h)\ 



B{k1 



9-1 



X = 



c-b 

X 



(21) 



(22) 



All the expressions depending on the variables are fully factorized; the part 
of the summand that contains the Zk is given by 



q-l- 



n 

k=l 



w{b,e, zk)riK + zk) 



2fce{o....,c-6}\{f,} 



Zk'- T, 



(G 



bal 



(23) 



□ 



Theorem [T] follows after some elementary rewriting. 
Proof of Theorem [H 

We start from as given by Theorem [T] The Gbae becomes Gta, so the factor 
Gl~^ can be moved out of the ^-sum. The w{b,£) becomes w{b) /{£+!) and w{b) 
can also be moved out of the-^-sum. The remaining sum is J^'eZo {'^^^) i^i''^ba/GbaY 
which evaluates to [{Gba + Vba)'^ — GIJGI'^'' /{qvba). Theorem [i] follows after sub- 
stituting the definition of Vba and some rewriting. □ 

Proof of Theorem [3l 



In (17) the W{b,£,z) becomes W{b,z). The definition of class 3 specifies that 
W{b,z) is either 1 or 0. The result (18) trivially follows. □ 



